Introducing the OpenAI Safety Bug Bounty program

OpenAI has opened a new front in its bug bounty program, and this one isn't about the usual stuff like SQL injection or leaked API keys. It's about safety failures — the kind where a model can be tricked into doing something it shouldn't, rather than a server being misconfigured. The company is now paying researchers specifically for finding agentic vulnerabilities, prompt injection techniques, and ways to exfiltrate data through model behavior itself.

This is a meaningful shift in how OpenAI frames risk. Traditional security bounties treat software as the attack surface. This program treats the model's judgment as the attack surface. If someone can craft a prompt that convinces an AI agent to leak sensitive information, take an unauthorized action, or bypass its own guardrails, that's now a paid finding, not just a curiosity buried in a Discord thread.

The timing tracks with where the industry's anxieties have moved. As OpenAI and its competitors push harder into agentic systems — models that browse, execute code, call APIs, and act with real autonomy — the failure modes get scarier. A chatbot that says something wrong is embarrassing. An agent with access to a user's email or codebase that gets manipulated into exfiltrating data is a genuinely different category of problem, and one that's much harder to test for internally.

OpenAI has run bug bounty programs before, but bolting safety research onto the existing bounty structure signals that the company wants outside eyes on failure modes its own red teams might miss or deprioritize. It's also a tacit admission that these systems are complex enough now that internal testing alone doesn't cut it. External researchers, financially motivated and creative in ways internal teams sometimes aren't, get pulled into the fold instead of publishing exploits for free on Twitter.

Whether the payouts are generous enough to attract serious talent remains to be seen, since OpenAI hasn't published a detailed reward tier for this track the way it has for classic security bugs. But the structural move itself — treating prompt injection and agentic exploits as bounty-worthy on par with a remote code execution bug — is a signal that OpenAI expects these to keep happening, at scale, for a while.